34 KiB
34 KiB
Decision Log
Architecture Decision Records (ADRs) for the Kandev project. Each decision captures the context, choice, consequences, and alternatives for significant architectural or design decisions.
Read individual ADRs for full context. Create new ones via /record decision or manually following the template in 0001-file-based-knowledge-system.md.
| ID | Title | Status | Area | Date |
|---|---|---|---|---|
| 0001 | File-based knowledge system | accepted (amended 2026-07-16) | infra | 2026-03-28 |
| 0002 | Host utility agentctl for sessionless ACP flows | accepted | backend | 2026-04-08 |
| 0003 | executors_running as the single source of truth for agent_execution_id | accepted | backend | 2026-05-03 |
| 0004 | Task model unification — shared base, per-strategy meta, shared kernel | proposed | backend, frontend | 2026-05-05 |
| 0005 | Agent model unification — one agents table |
proposed | backend, frontend | 2026-05-06 |
| 0006 | Tier routing vs cheap_agent_profile_id coexistence | superseded | backend | 2026-05-11 |
| 0007 | profiles.yaml — runtime defaults for prod / dev / e2e | accepted | backend, frontend | 2026-05-16 |
| 0008 | DB upgrade safety - meta table, pre-migration backup, migration logging | accepted | backend | 2026-05-16 |
| 0009 | Fail-closed GC semantics for filesystem and container cleanup | accepted | backend | 2026-05-16 |
| 0010 | Worktree copy-files — per-repo, idempotent, host-local | accepted | backend, frontend | 2026-05-19 |
| 0011 | Transient provider errors (529 Overloaded) auto-retry with visible backoff | superseded by 2026-08-08-provider-neutral-agent-error-recovery | backend, frontend | 2026-05-30 |
| 0012 | Service-only UI self-update | accepted | backend, frontend, cli | 2026-05-29 |
| 0013 | Multi-branch task support — N (repo, branch) pairs per task | accepted | backend, frontend | 2026-06-01 |
| 0014 | Per-CLI MCP server injection for passthrough mode | accepted | backend | 2026-05-29 |
| 0015 | Explicit completion signal for auto-advance | proposed (amended 2026-08-14) | backend, frontend | 2026-06-04 |
| 0016 | Read-only absolute file paths | accepted | backend | 2026-06-14 |
| 0017 | Resource metrics sampling | accepted | backend, frontend, protocol | 2026-06-14 |
| 0018 | Runtime settings overrides | accepted (amended 2026-08-11) | backend, frontend, cli | 2026-06-14 |
| 0019 | Restart supervisor owns backend restarts | accepted | backend, frontend, cli | 2026-06-14 |
| 0020 | Pi project MCP config injection | accepted | backend | 2026-06-16 |
| 0021 | Go-served SPA with boot state | accepted | backend, frontend, cli | 2026-06-15 |
| 0022 | Embedded Vite assets | accepted | backend, frontend, cli | 2026-06-17 |
| 0023 | Active workspace cookie for boot state | accepted | backend, frontend | 2026-06-18 |
| 0024 | Go-fronted Vite dev mode | accepted | backend, frontend, cli | 2026-06-18 |
| 0025 | Runtime cleanup uses executors_running |
accepted (amended 2026-07-06) | backend | 2026-06-22 |
| 0026 | Tauri desktop shell over native runtime | accepted (amended 2026-07-15) | frontend, backend, cli, infra | 2026-06-23 |
| 0027 | Replayable schema migrations across SQLite and Postgres | accepted | backend | 2026-06-24 |
| 0028 | Backend-owned task-create last-used preferences | accepted (amended by 0041) | backend, frontend | 2026-06-29 |
| 0029 | Release backfill and desktop diagnostics | accepted (amended 2026-07-16) | infra, workflow | 2026-07-01 |
| 0030 | Workspace-scoped integration settings | accepted | backend, frontend | 2026-07-01 |
| 0031 | Office skill reference files | accepted | backend | 2026-07-06 |
| 0032 | Configurable worktree branch names | accepted | backend, frontend | 2026-07-07 |
| 0033 | Durable plan implementation start marker | accepted | backend, frontend | 2026-07-09 |
| 0034 | Agent Client Protocol Codex ACP Bridge | accepted (amended 2026-07-25) | backend, protocol | 2026-07-10 |
| 0035 | Version AgentReady events by prompt generation | accepted | backend | 2026-07-14 |
| 0036 | Normalize ACP shell output at the adapter boundary | accepted | backend, frontend, protocol | 2026-07-14 |
| 0037 | Resource-aware frontend unit tests | accepted | frontend, infra | 2026-07-14 |
| 0038 | Quick Chat Repository Isolation | accepted | backend, frontend | 2026-07-14 |
| 0039 | Native desktop integration boundary | accepted (amended 2026-07-24) | desktop, frontend, backend, infra | 2026-07-15 |
| 0040 | Separate updater integrity from OS publisher identity | accepted | desktop, infra, workflow | 2026-07-15 |
| 0041 | Backend-owned portable user settings | accepted (amended 2026-07-31) | backend, frontend | 2026-07-15 |
| 0042 | Project shell output and fetch it on demand | accepted | backend, frontend, protocol | 2026-07-16 |
| 0043 | Plugins read/write kandev data via capability-gated Host gRPC RPCs | accepted | backend, protocol | 2026-07-17 |
| 2026-07-14-typed-utility-chat-sessions | Typed Utility Chats Share the Quick Chat Session Model | accepted | backend, frontend | 2026-07-14 |
| 2026-07-15-office-agent-execution-profile-routing | Separate Office identity from routed execution profiles | proposed | backend, frontend | 2026-07-15 |
| 0044 | ACP agent compatibility dialects | accepted | backend, protocol | 2026-07-16 |
| 0045 | Install-wide storage maintenance uses typed ownership providers and quarantine | accepted (amended 2026-07-22) | backend, frontend, infra | 2026-07-14 |
| 0046 | Settings route save coordinator | accepted (amended 2026-08-09) | frontend | 2026-07-14 |
| 0047 | Plugins read conversation content via a capability-gated Host RPC | accepted | backend, protocol | 2026-07-21 |
| 0048 | Plugins invoke a settings-selectable utility agent | accepted | backend, frontend, protocol | 2026-07-21 |
| 0049 | Fine-grained foreground-idle busy signal | superseded by 2026-07-28-coarse-running-busy-signal | backend, frontend, protocol | 2026-07-11 |
| 0050 | Plugins provide OIDC/SAML login via a capability-gated, host-minted session | accepted | backend, security, protocol | 2026-07-26 |
| 0051 | PR agent notifications extend task PR automation | accepted | backend, frontend, workflow, GitHub, MCP | 2026-07-23 |
| 2026-07-23-opencode-review-evidence-trust | Trusted OpenCode Review Evidence | accepted | workflow, infra | 2026-07-23 |
| 2026-07-23-planner-direct-small-work | Planner Direct Small Work | superseded by 2026-07-26 | workflow | 2026-07-23 |
| 2026-07-23-post-commit-hook-aware-verification | Post-Commit Hook-Aware Verification | superseded by 2026-07-26 | workflow | 2026-07-23 |
| 2026-07-23-workspace-source-root-move-boundary | Workspace Source Root Move Boundary | accepted | backend | 2026-07-23 |
| 2026-07-24-operator-owned-agent-launcher-settings | Operator-Owned Agent Launcher Settings | accepted | backend, frontend, protocol | 2026-07-24 |
| 2026-08-05-plugin-native-integration-settings | Plugins Contribute Native Integration Settings | accepted | frontend, protocol | 2026-08-05 |
| 2026-08-06-plugin-code-host-dashboard-parity | Code-Host Plugins Reuse Native Dashboard Primitives | accepted | frontend, protocol | 2026-08-06 |
| 2026-08-10-plugin-change-request-mutations | Route Native Change-Request Mutations Through Providers | accepted | frontend, protocol | 2026-08-10 |
| 2026-08-12-plugin-localization-contract | Host-Scoped Plugin Localization | accepted | frontend, protocol | 2026-08-12 |
| 2026-07-18-turn-configuration-snapshots | Attribute runtime configuration to turns | accepted | backend, frontend | 2026-07-18 |
| 2026-07-22-gpg-signed-release-tags | GPG-signed release tags | accepted | infra, workflow | 2026-07-22 |
| 2026-07-19-reject-mcp-actions-on-raw-websocket | Reject MCP Actions on the Raw WebSocket | accepted | backend, protocol | 2026-07-19 |
| 2026-07-19-workspace-symlink-entries | Treat Nested Workspace Symlinks as Entries | accepted | backend, infra | 2026-07-19 |
| 0047 | Separate GitHub deployment, workspace automation, and personal identities | accepted | backend, frontend, security | 2026-07-19 |
| 2026-07-20-managed-github-app-registration | Manage Self-Hosted GitHub App Registration at Runtime | superseded | backend, frontend, security | 2026-07-20 |
| 2026-07-20-explicit-local-repository-trust | Explicit Local Repository Trust | accepted | backend, frontend | 2026-07-20 |
| 2026-07-20-provider-neutral-remote-repositories | Provider-neutral remote repositories | accepted | backend, frontend, protocol | 2026-07-20 |
| 2026-07-21-workspace-selectable-github-app-registrations | Select GitHub App Registrations Per Workspace | accepted | backend, frontend, security | 2026-07-21 |
| 2026-07-20-repository-provider-origin-identity | Persist Provider Origin In Repository Identity | accepted | backend, frontend | 2026-07-20 |
| 2026-07-21-portable-status-bar-order | Portable Status Bar Order | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-21-work-item-reference-search | Backend-normalized work-item references | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-22-runtime-mutable-task-workspace-sources | Runtime-Mutable Task Workspace Sources | accepted (amended by 2026-07-27) | backend, frontend, protocol | 2026-07-22 |
| 2026-07-24-opt-in-authentication | Opt-in Authentication and Per-User Workspace Scoping | accepted | backend, frontend, protocol, security | 2026-07-24 |
| 2026-07-24-semantic-notification-events | Semantic notification events come from domain occurrences | accepted | backend, frontend, desktop | 2026-07-24 |
| 2026-07-26-user-managed-agent-runtime-updates | User-Managed Agent Runtime Updates | superseded by 2026-08-12-validated-managed-runtime-version-selection | backend, frontend, protocol | 2026-07-26 |
| 2026-08-12-validated-managed-runtime-version-selection | Validate and Persist Managed Runtime Version Selection | accepted | backend, frontend, protocol | 2026-08-12 |
| 2026-07-26-single-session-model-switching | Single-Session Model Switching | accepted (amended 2026-07-27) | workflow, infra | 2026-07-26 |
| 2026-07-27-task-git-credential-policy | Separate GitHub Automation From Task Git Credential Policy | accepted | backend, frontend, security | 2026-07-27 |
| 2026-07-27-spa-failure-containment-and-deployment-recovery | SPA Failure Containment and Deployment Recovery | accepted | frontend | 2026-07-27 |
| 2026-07-27-legacy-add-branch-live-rescan | Preserve Live Rescan for Legacy Add Branch | accepted | backend, protocol | 2026-07-27 |
| 2026-07-28-visible-wip-overflow-queues | Separate Visible Queueing From WIP Admission | proposed | backend, frontend, protocol, workflow | 2026-07-28 |
| 2026-08-12-queue-task-moves-at-wip-capacity | Queue Task Moves at WIP Capacity | accepted | backend, frontend, protocol, workflow | 2026-08-12 |
| 2026-08-15-subagent-context-schema-boundary | Start with the execution-aware subagent schema | accepted | backend | 2026-08-15 |
| 2026-08-15-portable-agent-configuration-bundles | Use Explicit Portable Agent Configuration Bundles | accepted | backend, frontend, protocol, security | 2026-08-15 |
| 2026-08-15-executor-authoritative-model-selection | Let the Executor Own Model Selection | accepted | backend, frontend, protocol, persistence | 2026-08-15 |
| 2026-07-28-coarse-running-busy-signal | Restore Coarse Running Prompt Admission | accepted | backend, frontend, protocol | 2026-07-28 |
| 2026-07-29-agent-stall-user-controlled-recovery | Keep Agent Stall Recovery User Controlled | accepted | backend, frontend, protocol | 2026-07-29 |
| 2026-07-29-quarantine-retention-override | Make Quarantine Retention Overridable but Visible | accepted | backend, frontend | 2026-07-29 |
| 2026-07-29-interactive-accent-surface-semantics | Separate Brand Accent from Interactive Surface Fills | accepted | frontend | 2026-07-29 |
| 2026-07-30-embedded-editor-executor-capabilities | Derive Embedded Editor Availability from the Active Executor | accepted | backend, frontend, protocol | 2026-07-30 |
| 2026-07-30-session-owned-mcp-observability | Keep MCP Attachment Evidence Session Owned | accepted | backend, frontend, protocol, security | 2026-07-30 |
| 2026-07-30-file-backed-diagnostic-bundles | File-backed diagnostic bundles | accepted | backend, frontend, infra, protocol, workflow | 2026-07-30 |
| 2026-07-30-runtime-task-state-before-running-event | Publish Task State Before Running Session State | accepted | backend, frontend, protocol, workflow | 2026-07-30 |
| 2026-07-31-authenticated-plugin-actions | Authenticated Plugin Actions | accepted | backend, frontend, protocol, security | 2026-07-31 |
| 2026-07-31-plugin-repository-provider-extensions | Plugin Repository Provider Extensions | accepted | frontend, backend, protocol | 2026-07-31 |
| 2026-07-31-provider-neutral-git-credential-broker | Provider-Neutral Git Credential Broker | accepted | backend, protocol, security | 2026-07-31 |
| 2026-08-01-bitbucket-initial-release-remains-unsigned | Bitbucket Initial Release Remains Unsigned | accepted | infra, workflow, security | 2026-08-01 |
| 2026-07-31-npm-nightly-release-channel | Publish deterministic npm-only nightlies | accepted (amended 2026-08-03) | workflow, backend, frontend, cli | 2026-07-31 |
| 2026-07-31-isolate-manual-pr-review-content | Isolate Manual PR Review Content | accepted | infra, workflow, security | 2026-07-31 |
| 2026-07-31-agent-generated-task-titles | Bind Agent Title Generation to Pending Tasks | accepted | backend, frontend, protocol | 2026-07-31 |
| 2026-07-31-system-service-user-continuity | Preserve System Service Identity Across Reinstallation | accepted | backend, cli, security, operations | 2026-07-31 |
| 2026-08-01-workflow-session-original-configuration | Keep Workflow Restoration Separate From Provider Defaults | accepted | backend, frontend, workflow | 2026-08-01 |
| 2026-08-01-repository-task-executor-defaults | Resolve Task Executor Policy Before Last-Used Profile | accepted | frontend | 2026-08-01 |
| 2026-08-01-validate-mcp-tool-arguments | Validate MCP Tool Arguments at the Shared Server Boundary | accepted | backend, protocol | 2026-08-01 |
| 2026-08-01-separate-task-summary-session-stream-traffic | Separate Task Summary and Session Stream Traffic | accepted | backend, frontend, protocol | 2026-08-01 |
| 2026-08-01-global-run-scheduler-ownership | Separate Global Run Dispatch from Office Maintenance | accepted | backend, workflow | 2026-08-01 |
| 2026-08-01-architecture-lint-budgets | Architecture Lint Budgets and Compatibility Expiry | accepted (amended 2026-08-02) | infra | 2026-08-01 |
| 2026-08-01-release-toggle-gating-contract | Release Toggles Are Install-Wide Fail-Closed Gates | proposed | backend, frontend, workflow | 2026-08-01 |
| 2026-08-01-share-artifact-locale | Shared-Task Artifacts Render in the Creator's Locale | accepted | backend | 2026-08-01 |
| 2026-08-01-gitlab-mr-lifecycle-notifications | GitLab MR Lifecycle Notifications | accepted | backend, frontend | 2026-08-01 |
| 2026-08-01-per-user-plugin-storage | Host-Provided Per-User Plugin Storage | accepted | backend, frontend, security | 2026-08-01 |
| 2026-08-11-composer-access-authenticated-webhooks | Composer Access and Authenticated Webhooks | accepted | frontend, backend, protocol, security | 2026-08-11 |
| 2026-08-01-plugin-task-panel-contributions | Plugin Task Panel, Kanban Menu Action, and Card Indicator Contributions | accepted | frontend | 2026-08-01 |
| 2026-08-02-new-workspace-github-access-defaults | Bootstrap New Workspaces From Host GitHub Access | accepted | backend, frontend, security | 2026-08-02 |
| 2026-08-02-explicit-user-cancel-completion | Explicit User Cancellation May Complete a Workflow Step | accepted | workflow | 2026-08-02 |
| 2026-08-02-single-owner-agent-task-titles | Assign Agent Task Titles to One Session | accepted | backend, frontend, protocol, workflow | 2026-08-02 |
| 2026-08-02-agent-terminal-diagnostics-over-stderr | Capture Agent Terminal Diagnostics From Managed Stderr | accepted | backend, frontend, protocol, security | 2026-08-02 |
| 2026-08-07-allowlisted-provider-action-links | Allowlisted Provider Action Links | accepted | backend, frontend, protocol, security | 2026-08-07 |
| 2026-08-08-provider-neutral-agent-error-recovery | Separate Agent Error Evidence From Recovery Policy | accepted | backend, frontend, protocol | 2026-08-08 |
| 2026-08-08-utility-agent-profile-execution | Utility Agents Use Execution Profiles | accepted | backend, frontend, protocol | 2026-08-08 |
| 2026-08-08-utility-profile-dependency-safety | Warn Before Breaking Utility Profile Bindings | accepted | backend, frontend, protocol | 2026-08-08 |
| 2026-08-02-class-aware-git-subprocess-admission | Class-Aware Git Subprocess Admission | accepted | backend, agentctl, observability | 2026-08-02 |
| 2026-08-02-isolate-replaceable-session-stream-traffic | Isolate Replaceable Session Stream Traffic | accepted | backend, frontend, protocol | 2026-08-02 |
| 2026-08-03-backend-owned-cancellation-progress | Keep Cancellation Progress Backend Owned | accepted | backend, frontend, protocol | 2026-08-03 |
| 2026-08-03-separate-message-queue-provenance-cancellation-and-capacity | Separate Message Queue Provenance, Cancellation, and Capacity | accepted | backend, frontend, protocol, security | 2026-08-03 |
| 2026-08-03-provider-scoped-task-mcp-tools | Derive Provider-Scoped Task MCP Tools in the Backend | accepted | backend, agentctl, protocol, integrations | 2026-08-03 |
| 2026-08-05-queue-send-now-replaces-turn | Queue Send Now Replaces the Active Turn | accepted | backend, frontend, protocol, workflow | 2026-08-05 |
| 2026-08-04-file-backed-prompt-attachments | File-backed prompt attachments | accepted | backend, frontend, protocol, infra | 2026-08-04 |
| 2026-08-04-plugin-contribution-lifecycle-authority | Make Plugin Contribution Lifecycle Authoritative | accepted | frontend, security | 2026-08-04 |
| 2026-08-04-navigation-manifest-boundaries | Centralize Navigation and Namespace Plugin Destinations | accepted | frontend | 2026-08-04 |
| 2026-08-04-mid-turn-steering | Deliver Operator Input Into a Generating Turn | accepted | backend, frontend, protocol | 2026-08-04 |
| 2026-08-04-remote-contribution-bindings | Bind Remote Contributions to Target Repositories | accepted | backend, protocol, security, GitHub, GitLab | 2026-08-04 |
| 2026-08-03-scope-and-merge-repository-secrets | Scope and Merge Repository Secrets | accepted | backend, frontend, security, protocol | 2026-08-03 |
| 2026-08-05-server-owned-quick-terminal-descriptors | Server-Owned Quick Terminal Descriptors | accepted | backend, frontend, protocol, security | 2026-08-05 |
| 2026-08-05-nested-submodules-as-repository-scopes | Model Nested Submodules as Repository Scopes | accepted | backend, frontend, protocol | 2026-08-05 |
| 2026-08-05-homebrew-remote-helper-audit | Preserve Remote Helpers in Homebrew Installs | accepted | infra, workflow | 2026-08-05 |
| 2026-08-07-model-aware-provider-capability-resolution | Model-aware provider capability resolution | accepted | backend, frontend, protocol | 2026-08-07 |
| 2026-08-07-claude-allowlist-label-bridge | Use the Claude Allowlist as a Trusted Preview Gate | accepted | infra, workflow, security | 2026-08-07 |
| 2026-08-08-task-autopilot-contract | Make Task Autopilot a Creation-Time Runtime Contract | accepted | backend, agentctl, frontend, protocol, workflow | 2026-08-08 |
| 2026-08-08-autopilot-mcp-question-capabilities | Use One Question Capability Per Task Session | accepted | backend, agentctl, protocol | 2026-08-08 |
| 2026-08-08-mcp-tool-profiles | Compose MCP Tool Profiles From Typed Context | accepted | backend, agentctl, protocol, workflow | 2026-08-08 |
| 2026-08-08-agentctl-crash-containment | Publish Immutable Agent Events and Explicit Runtime Failure State | proposed | backend, frontend, protocol, operations | 2026-08-08 |
| 2026-08-08-workspace-scoped-task-create-workflow-memory | Remember Task-Create Workflows Per Workspace | accepted | backend, frontend | 2026-08-08 |
| 2026-08-08-owned-temp-artifact-cleanup | Clean only registered Kandev temporary artifacts | accepted | backend, frontend, infra, security | 2026-08-08 |
| 2026-08-08-task-owned-worktree-lifetime | Keep Worktree Ownership at the Task Lifecycle | accepted | backend, frontend | 2026-08-08 |
| 2026-08-08-go-launcher-owns-all-launch-modes | The Go Launcher Owns Every Entrypoint; apps/cli Is a Publish-Only Shim | accepted | backend, cli, infra | 2026-08-08 |
| 2026-08-09-bind-automation-mutations-to-event-targets | Bind Automation Mutations to Event Targets | accepted | backend, agentctl, protocol, security, workflow | 2026-08-09 |
| 2026-08-09-exclusive-runtime-state-ownership | Lock Runtime State Before Backend Startup | accepted | backend, infra | 2026-08-09 |
| 2026-08-10-duration-aware-e2e-sharding | Duration-aware E2E sharding uses rolling main timings |
accepted | infra, workflow | 2026-08-10 |
| 2026-08-10-debug-launcher-profile-selection | Keep Debug Launches on the Production Profile | accepted | backend, frontend, cli | 2026-08-10 |
| 2026-08-11-plugin-tools-through-kandev-mcp | Route Plugin Agent Tools Through Kandev MCP | accepted | backend, agentctl, protocol, plugins, security | 2026-08-11 |
| 2026-08-10-remote-contribution-head-drift | Separate Current Contribution and Local Checkout Histories | accepted (remote-action policy superseded, provider-error presentation amended) | backend, frontend, protocol, GitHub, GitLab | 2026-08-10 |
| 2026-08-12-local-first-contribution-replacement | Keep Remote Contribution Work Local-First | accepted | backend, frontend, protocol, security, GitHub, GitLab | 2026-08-12 |
| 2026-08-13-provider-history-changes-enrichment | Treat Provider History as Changes Enrichment | accepted | frontend, GitHub, GitLab | 2026-08-13 |
| 2026-08-11-user-owned-status-bar-visibility | Make Status Bar Visibility a Portable User Preference | accepted | backend, frontend, protocol | 2026-08-11 |
| 2026-08-12-built-in-utility-default-inheritance | Built-in Utility Actions Inherit the Global Profile by Default | superseded by 2026-08-12-empty-utility-bindings-inherit-default | backend, frontend | 2026-08-12 |
| 2026-08-12-empty-utility-bindings-inherit-default | Empty Built-in Utility Bindings Inherit the Default | accepted | backend, frontend | 2026-08-12 |
| 2026-08-12-setup-timeout-owns-launch-budget | One Setup Timeout Owns Launch Budgets | accepted | backend | 2026-08-12 |
| 2026-08-10-no-em-dash-public-copy | Keep Em Dashes Out of Public Copy | accepted | frontend, infra | 2026-08-10 |
| 2026-08-14-current-turn-clarification-ownership | Current Turn Owns Active Clarification | accepted (amended 2026-08-15) | backend, frontend, protocol, workflow | 2026-08-14 |
| 2026-08-12-task-bound-fork-destinations | Bind Fork Push Destinations to Tasks | accepted (amended 2026-08-13) | backend, frontend, workflow, security, GitHub | 2026-08-12 |
| 2026-08-13-hard-delete-task-contribution-links | Hard delete owns task contribution links | accepted | backend | 2026-08-13 |
| 2026-08-15-office-mode-follows-active-workspace | Office Mode Follows the Active Workspace | accepted | frontend, backend | 2026-08-15 |